test(permissions): drop alias-presenting grant tests

Live requests never present as aliases (coerced before matching), so
tests presenting update_plan requests exercise an unreachable path.
Fail-closed pins and seeder tests remain.

Author: TheGreatAxios

src/agent/canonical-tool-name.ts

@@ -32,7 +32,9 @@ export function canonicalToolName(requested: string): string {
 // a stored manage_tasks (engine) grant covers update_plan use, but a stored
 // update_plan grant covers only update_plan-presenting requests — never a
 // manage_tasks request, which may carry update/cancel payloads the operator
-// never approved.
+// never approved. The update_plan-presenting allowance is unreachable live
+// (requests are post-coercion and seeders drop stored update_plan keys); it
+// exists only so direct match-API callers keep narrow-narrow coverage.
 export function grantToolCovers(
   storedTool: string,
   requestTool: string,

src/agent/tool-aliases.test.ts

@@ -125,6 +125,9 @@ describe("grant aliases", () => {
   // todo/doing/done statuses, while manage_tasks spans the full lifecycle
   // (create/update, including cancelled). Grant coverage is one-directional:
   // a stored update_plan grant must never cover a manage_tasks request.
+  // Live requests never present as aliases (coerced before matching) and
+  // seeders drop stored update_plan keys, so no same-alias replay test exists
+  // here: that path is unreachable in production.
   test("a stored update_plan grant does not cover manage_tasks", async () => {
     expect(
       await evaluateApprovals({
@@ -136,26 +139,7 @@ describe("grant aliases", () => {
     ).toBe(false);
   });
 
-  test("a stored update_plan grant still covers update_plan (create-equivalent) use", async () => {
-    expect(
-      await evaluateApprovals({
-        tool: "update_plan",
-        subject: "update_plan",
-        approvals: [{ tool: "update_plan", pattern: "*" }],
-        workspace: noWorkspace,
-      }),
-    ).toBe(true);
-  });
-
-  test("a stored manage_tasks grant covers update_plan (engine covers alias)", async () => {
-    expect(
-      await evaluateApprovals({
-        tool: "update_plan",
-        subject: "update_plan",
-        approvals: [{ tool: "manage_tasks", pattern: "*" }],
-        workspace: noWorkspace,
-      }),
-    ).toBe(true);
+  test("a stored manage_tasks grant covers manage_tasks", async () => {
     expect(
       await evaluateApprovals({
         tool: "manage_tasks",

src/permission/grant-scope.test.ts

@@ -43,7 +43,6 @@ describe("grant tool/providerModel/cwd scoping agrees across call sites", () =>
     { tool: "run_shell", cwd: undefined, activeProviderModel: undefined },
     { tool: "write_file", cwd: "/proj", activeProviderModel: undefined },
     { tool: "manage_tasks", cwd: "/proj", activeProviderModel: undefined },
-    { tool: "update_plan", cwd: "/proj", activeProviderModel: undefined },
   ];
 
   for (const grant of grants) {
@@ -107,23 +106,6 @@ describe("grant tool/providerModel/cwd scoping agrees across call sites", () =>
       }),
     ).toBe(false);
   });
-
-  test("stored manage_tasks grant covers an update_plan-presenting request", async () => {
-    const grant: Approval = { tool: "manage_tasks", pattern: "*" };
-    expect(
-      grantScopeMatches(grant, "update_plan", undefined, "/proj", workspace),
-    ).toBe(true);
-    expect(
-      await approvalCoversSubject({
-        tool: "update_plan",
-        subject: "update_plan",
-        approvals: [grant],
-        activeProviderModel: undefined,
-        requestCwd: "/proj",
-        workspace,
-      }),
-    ).toBe(true);
-  });
 });
 
 // Seeded grants enter the gate in native key space. Pure renames collapse onto